@manton like most of the major AP apps, it uses OAuth. I’m playing a little loose with the Masto/AP distinction — there is enough capability that various front ends and clients interoperate around the basics.
I understand your reluctance, but it makes Mb a bit of a stand-alone. You’re at the “center” of a bunch of IndieWeb stuff … but as it stands, there aren’t viable IW federated servers. AP’s federation is the closest we have.
Anyway, thanks for the discussion!